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The challenges facing the banking 
industry in 2020 have been 
unprecedented and reminded us all 

of the importance of adaptability and 
embracing change. One positive change 








The same is true for the groups of banks 
we have been working with over the last 
12 months: 80% of Accelerator banks — 
those at an early stage of the adoption 
cycle — are now using or planning to use 


has been the increasing use of regulatory AML/CFT Regtech solutions, while 77% 
technology ("Regtech"), which has played of Enabler banks — which had explored 
a key part in helping to keep vital banking implementing machine learning in 


services available in rapidly changing 
circumstances. In particular, the 


transaction monitoring and screening — 
are now either using it, conducting proofs 


challenging operating conditions brought of concept (PoC), or have concrete plans 


about by COVID-19 have triggered 
accelerating Regtech exploration and 
adoption since the first Anti-Money 
Laundering and Counter-Financing of 
Terrorism ("AML/CFT") RegTech Forum in 
November 2019. 


This is particularly true for the provision 
of remote services. About 90% of all 
retail banks have either launched or 
plan to launch remote on-boarding for 
individuals using Regtech solutions and 
there has been strong growth in testing 
remote customer on-boarding initiatives 
for corporates through the Hong Kong 
Monetary Authority ("HKMA") Fintech 
Supervisory Sandbox. 


to do so. 


Encouraging as these results are, there 
is still more to be done. Throughout 
2020, the HKMA, working with 

Deloitte, has been engaging industry 
stakeholders to better understand the 
factors and dependencies affecting 
AML/CFT Regtech adoption and, more 
importantly, considering how we should 
respond. This is the first time that we 
document and share comprehensive 
hands-on experience from banks that 
have implemented or are implementing 
AML/CFT Regtech, and forms part of 
the HKMA's overall Regtech promotion 
initiative. 





pe 








Involving multiple stakeholders in AML/ 
CFT Regtech adoption is essential if we 
are to capitalise on the benefits. Banks 
that have already done this emphasise a 
number of key insights: 


the importance of early and continuing 
stakeholder buy-in; 


the need for interdisciplinary adoption 
teams with broad perspectives; 


the value of forums to share views and 
experience; and 


the ability to track and measure 
success. 


The adoption of Regtech for AML/CFT 
will continue to be a strong focus in the 
HKMA's supervisory engagement with 
the industry as well as individual banks. 
We will undertake further initiatives, 
working closely with all stakeholders, in 
the coming year to support our vision for 
AML/CFT Regtech in Hong Kong. 


Arthur Yuen 
Deputy Chief Executive 
Hong Kong Monetary Authority 
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Executive 


Summa 


THE KEY TO THE FUTURE IS 
COLLABORATION 


In its 2019 Mutual Evaluation Report on 
Hong Kong, the Financia 


Force ( 


"BATIR 


| Action Task 


recognised the efforts 
and contribution of the H 


MA and the 


banking sector as a key part of the AML/ 


the HK 
AML/C 
follow 





proacti 


promo 
Regtec 
our ba 


Despite the unpreceden 


posed 


two parallel trac 
our supervisory activity to ma 
ve, targeted and collaborative; and 
ting responsible innovation and 





FT developments 











h adoption for A 
nks." 





by COVID-19, sign 


gto 


CFT ecosystem in Hong Kong." Building 
on that assessment, and 
ternational financial centres, we must 
tay agile in respondin 
opportunities resulting from new and 

emerging technologies. The steps that 
MA is taking reflect international 


ike other similar 








the risks and 


and broadly 


s: changes to 


e it more 





L/CFT purposes in 





ted challenges 
ificant results have 


been achieved in both areas. In September 


2020, t 





he HKMA shared 


its vision and 


roadmap for becoming more data-driven 
and technology-enabled in its AML/CFT 
work through the use of supervisory 


techno 


logy (“Suptech”)." 





And since the AML/CFT RegTech Forum in 
2019, which brought together stakeholders 
from both public and private sectors, the 
HKMA has continued to collaborate and 
coordinate efforts through various means, 
including for example a knowledge and 
experience-sharing workshop on network 
analytics with member banks of the 
Fraud and Money Laundering Intelligence 
Taskforce ("FMLIT")” There are already 
examples where some of the techniques 
described in this report are delivering 
improved outcomes , such as neutralising 
mule account networks linked to face mask 
scams. 


























The aim of this report is to sustain these 
developments and support coordination 
and collaboration across the ecosystem by 
sharing insights from early adopters of AML/ 
CFT Regtech with those that are currently 
planning their own initiatives. By focusing on 
industry case studies, the report illustrates 
various approaches that different banks 
have taken to AML/CFT Regtech adoption 
to address a number of common themes 
across the experiences of early adopters. 
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FINDING THE RIGHT TOOLS 
FOR THE JOB 


This report is not meant to be prescriptive. 
Rather, it describes industry practices 

and insights that all banks can use to 
assess how the changing technology 
landscape in financial services will impact 
their exposure to money laundering and 
terrorist financing ("ML/TE") risks, and 
whether AML/CFT Regtech applications 
are right for them now or in the future. 





The modernisation 
of Supervisory 
activities should go 
hand-in-hand with 
the adoption of 
AML/CFT Regtech 
by the private 
SO 


LOOKING AHEAD 


Over the coming year, data and technology 
will continue to be a key focus in our 2021 
AML/CFT supervisory programme. We will 
continue to prioritise the use of Suptech to 
supplement and enhance our risk-based 
approach ("RBA") to AML/CFT supervision. 
Our promotion of responsible innovation 
and the adoption of AML/CFT Regtech will 
also continue through a range of events, 
including experiential labs, publications and 
other avenues to engage the industry. 


ACKNOWLEDGMENTS 


This report would not have been possible 
without the active participation of banks, 
technology providers and others, who 
generously offered their time and expertise 
during these historically challenging 

times. We are sincerely grateful to these 
professionals, for their support of our vision 
of collaboration. 





Key Observations 





STAKEHOLDER BUY IN & EXECUTIVE SUPPORT 


Secure buy in and support early and throughout the Regtech 
adoption journey. Ensuring management expectations were aligned 
to the proposed approach have helped many early adopters build 
credibility with management especially for more complex and 
larger scale deployments of AML/CFT Regtech. 


CROSS FUNCTIONAL & INTERDISCIPLINARY TEAMS 


Diversity broadens perspectives and enables banks to 
comprehensively evaluate third party Regtech vendors, identify 
any additional benefits / uses for a solution, anticipate and address 
potential barriers to implementation, and secure the buy in. The 
trust and relationships formed across these teams also carry 
forward to future AML/CFT Regtech initiatives. 


FORUMS TO EXCHANGE VIEWS & EXPERIENCES 


From exchanging operational techniques using innovative 
technologies and analytic methods to crowdsourcing answers to 
implementation challenges, many early adopters especially those 
that are part of large banking groups — found creating forums to 
share and exchange ideas and experiences had accelerated AML/ 
CFT Regtech adoption. 


FOCUS ON DATA READINESS 


Data is often where the “rubber meets the road” for AML/CFT 
Regtech initiatives. Do not underestimate the time, effort and 
support required to source and prepare essential data. Early 
adopters stress the importance of starting discussions with data 
owners early and planning ahead. 


WORKING WITH THIRD PARTIES 


When assessing opportunities to partner with third parties, early 
adopters have looked at compatibility (“does it work with our 
systems and meet our needs?”), scale (“can the solution or vendor 
perform beyond a pilot deployment?”) and sustainability (“what do 
we expect the vendor to look like in three to five years’ time?”). 


CONSIDERING A HOLISTIC DEFINITION OF VALUE 


In tracking and measuring success, efficiency and effectiveness 
are naturally important elements of the return on investment. 
Many early adopters of AML/CFT Regtech look beyond immediate 
financial and operational benefits and include the people impact 
through experiential learning and cross functional collaboration, 
the customer impact, and adaptability in terms of further uses. 
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Section | 


Introduction 


AML/CFT REGTECH: FINDING THE RIGHT 
TOOLS FOR THE JOB 


f we go back only a handful of years, 

few financial institutions were discussing 
he potential application of emerging 
technologies, such as graph database 
models and machine learning techniques, 
o AML/CFT efforts. Today, it is difficult to 
imagine a conversation on the future of 
AML/CFT practices without at least some 
consideration of the many questions 
concerning the possibilities, risks and 
challenges introduced by these innovative 
technologies. 








Nevertheless, while the central role of data 
and technology is clear to all, the way each 
institution should approach and engage 
these emerging technologies may not be. 
Put simply: how can our institution get 
started with AML/CFT Regtech adoption? 





On this question, building on the well- 
established RBA principles, AML/CFT 
Regtech adoption should be about 
defining a tailored approach for the unique 
characteristics of each institution. The 
volume of technology applications or the 
adoption of newer or more sophisticated 
technologies doesn't necessarily indicate 
maturity or translate into efficiency and 
effectiveness gains. 














Despite transformative advances in 
capability, technology remains a tool (or, at 
best, an assistant or a partner), and finding 
the right tools for the job with a well- 
defined governance model for responsible 
use should be the overarching objective of 
any AML/CFT Regtech adoption initiative. 








While the most cutting-edge technologies 
may not be for every institution now, all 
banks should carefully assess how the 
changing technology landscape in financial 














services will impact th 
TF risks, and whether 





eir exposure to ML/ 
AML/CFT Regtech 


applications, such as those involving 








elements of machine 
them now or in future 


earning, are right for 


RAISING AWARENESS, LOWERING 
BARRIERS AND ENCOURAGING 
COLLABORATION 


To understand how the HKMA and 
other members of Hong Kong's AML 
CFT ecosystem could help banks, in June 
2019, the HKMA partnered with Deloitte 
to begin collecting data on how and to 
what extent banks were using innovative 
technologies and techniques in their AML/ 
CFT programmes. 


~ 








The survey found that about one third of 
the 196 respondents were using one or 
more of the eight technologies included in 
the functional definition of Regtech. 













REGTECH DEFINITION 


Our understanding of Regtech will evolve along with the technology 
landscape. Our current functional definition was: applications or 

solutions used within AML/CFT programmes that leverage one or more 
of the technologies below. 















Network / Graph 


Robotic Process 
Analytics 


gay Automation (RPA) 


al Optical Character Natural Language Processing / 


Recognition (OCR) ay Generation (NLP/NLG) 


Distributed Ledger Technology 


Recognition (DLT) 


5) Cloud Computing Machine Learning 
© Facial / Voice © 






































A detailed look at the response data had not adopted any Regtech applications; techniques that are beginning to emerge 
led to some interesting observations. challenges encountered prior to and overseas. 
First, adoption was much lower among during adoption; and what internal and 
institutions with under one million external support banks felt they needed For these reasons, we decided to focus this 
customers. Second, institutions fell into to better understand current technology report on building awareness, and lowering 
three maturity groups according to the applications and their potential. the real and perceived barriers to AML/CFT 
technologies and techniques adopted: Regtech adoption by sharing case studies 
those that are non-adopters, those that The main takeaway from the conversations drawn from a diverse set of early adopters, 
have adopted Robotic Process Automation was that early adopters were eager to share who have first-hand knowledge of common 
("RPA"), and those that have adopted or are their knowledge and non-adopters were themes associated with AML/CFT Regtech 
adopting more sophisticated technologies eager to learn. As one of the participants adoption. 
and techniques such as network/graph from the November 2019 event put it: 
analytics and artificial intelligence ("Al") “banks can compete on everything, but if 
(e.g. machine learning, natural language we compete on the effectiveness of our 
processing). And third, adoption rates AML/CFT controls, then we all lose.” 
among banks with retail customers were 
comparable to those among non-retail It is easy to see why collaboration makes 
ones. sense: AML/CFT is a team effort that 
involves banks and other stakeholders 
These observations led us to set up from across the ecosystem. As the 
conversations with local and regional application of innovative technologies in 
representatives from the AML and financial financial services accelerates, institutions 
crime risk, compliance, technology and that don't adapt risk being vulnerable 
operations functions of around 40 banks— to exploitation—often referred to as 
both adopters and non-adopters—to “displacement risk”. These banks could also 
better understand how some were find it increasingly difficult to participate 
approaching Regtech as a means to in sector-level initiatives, such as future 
enhance AML/CFT processes; why others data and intelligence sharing partnerships, 
which could detract from maximising the 





utility of sector-level AML/CFT analytic 
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INDUSTRY CASE STUDIES 
& INSIGHTS ON ADOPTION 


In addition to early adopters’ eagerness 
to collaborate, we also learned through 


th 


th 


Le 








th 


e conversations that many AML/CFT 


professionals were looking for two things: 


e experiences of peers who have been 


involved in the adoption of innovative 


chnologies into their institution's AML/ 


CFT programmes; and insights into how 


ese early adopters overcame common 


challenges. 


The goal is to show not only the real 
possibilities of innovative technologies 

in AML/CFT, but also that successful 
deployment is not limited to the largest, 
most complex financial institutions. As 
the HKMA has advocated, there is no one- 
size-fits-all approach to AML/CFT Regtech 
adoption. 


In Section Ill, insights from interviews 
with practitioners from the six banks 
and technical experts from the industry 
are provided on five themes that were 
identified during the 2019 AML/CFT 


The following sections aim to address 
these points. In Section Il, six banks 
offer unique perspectives into possible 
approaches for AML/CFT Regtech 
adoption. 
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by early adopters in their pursui 
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t of AML/ 


CFT Regtech adoption: approaches 
to getting started; data and process 


readiness; third-party vendor re 


people, talent and culture; and how to 


measure value and success. 
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The use cases and themes discussed here 
represent only a fraction of a much larger 
industry discussion around the use of 
innovative technologies for AML/CFT, let 
alone the use of innovative technology in 
banking and financial services generally. 
The topics for this report were selected 
with the immediate aim of making AML/CFT 
Regtech as inclusive as possible by raising 
awareness and fostering collaboration. 
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“Given the dynamic nature of risk, and the volume and speed of 
data that banks are monitoring, screening and analysing, there 
is an obvious role for technology and Regtech to help in this 
process. The HKMA is committed to supporting the banking 
sector in its use of Regtech for AML work.” 


Carmen Chu, Executive Director (Enforcement and AML), HKMA. 
From the closing remarks of the HKMA AML/CFT RegTech Forum, 
22 November 2019. 
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Section || 


Case Studies 
in AML/CFT 
Regtech Adoption 


Our engagements with many early adopters of AML/CFT Regtech 

in Hong Kong and the Asia Pacific region showed that, while many 
institutions share an interest in similar technologies or approached 
Regtech adoption with similar goals, the actual adoption journey has 
been unique for each institution. 


For example, while Bank B began with a technology—RPA—and 
explored ways to apply it to legacy AML/CFT processes, others 
began with an existing challenge, such as managing operational 
efficiency, and explored using technologies such as RPA to address it. 


Is one approach better than the other? If you speak with 
representatives from each of these institutions, they will tell 
you it depends. It depends on the size, scale and complexity of 
your organisation, as well as the short, medium and long-term 
expectations and objectives you're placing on the technology 
solution. 





The following section, therefore, aims to describe, rather than 
prescribe, a set of best practices. By highlighting approaches and 
experiences that have yielded positive results for institutions with 
varying characteristics, readers may find case studies that resonate 
with them. 





Bank A 
Network Analytics and Non Traditional 
Data Elements for Investigations 


Bank B 
RPA within Name Screening and Adverse 
Media Searches 


Bank C 
RPA within Transaction Monitoring Alert 
Investigations 


Bank D 
Data Warehousing and Proactive AML/CFT 
Data Analytics Reviews 


Bank E 
Machine Learning and NLP/NLG for Name 
Screening 


Bank F 
Network Analytics for Fraud and Trade 
Based Money Laundering Investigations 
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Find the case studies that are relevant for your institution by referring to the following icons. 


TECHNOLOGIES IN USE 


Cloud & Data Storage : f 
RPA E Machine Learning 
© Network Analytics NLP / NLG 


SUGGESTED AUDIENCE 


Q Accelerators Enablers Collaborators 


Institutions at an early stage of Institutions considering adopting Mature adopters and members of 
the AML/CFT Regtech adoption machine learning and other FMLIT. 
journey. cognitive technologies. 
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Bank A 


Bank Ais a Hong Kong subsidiary of a global bank offering a wide range of services, including retail 
products, in multiple Asia-Pacific markets. Building on the experiences of its group head office and other 


regional hubs, Bank Ais a fast-follower in applying Regtech for AML/CFT. 


CONTEXT & BACKGROUND 


In 2020, Bank A in Hong Kong established 
an internal taskforce on AML/CFT Regtech, 
chaired by the Money Laundering Reporting 
Officer ("MLRO"), to identify opportunities to 
enhance the bank's AML/CFT processes and 
controls through deployment of Regtech. 


One of the ideas picked up by the taskforce 
early on was to explore an emerging trend 

across peer banks and public sector 
agencies to incorporate non-traditional 
AML/CFT data elements, such as IP 
addresses, to identify otherwise undisclosed 
networks of relationships between 
customers. 











The use of network analytics and IP 
addresses was new to Bank Ain Hong Kong, 
but not entirely new to the wider group. 
Financial crime risk specialists in other 
regions had attempted to form networks 
using IP addresses as an attribute. However, 
these experiments failed to produce 
meaningful insights that could be actioned 
by the relevant Financial Intelligence Units 
"FIU"). The early lessons from their overseas 
peers led the taskforce and the Head of the 
Hong Kong FIU to take a more incremental, 
use case-driven approach for their initiative, 
which in retrospect was a key success factor. 
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REGTECH APPLICATION 


Once Bank A defined the high-level 
purpose of the experiment—to identify 
hidden suspicious relationships using 
non-traditional data elements—they 
needed to determine the relevant entities 
and attributes for the exercise, and the 
methodology for aggregating and analysing 
the data set. 


Working off of insights generated from 
analysing suspicious transaction report 
"STR") trends, Bank A focused on a group 
f around 50 customers based in the Asia- 
Pacific region. They also defined a network 
ontology that included several attributes, 
including: basic demographic details, 

such as customer name and residential 
address; transactional data; and—most 
interestingly—data relating to a customer's 
digital footprint, such as information 
concerning login attempts to their online 
banking account (date, time and location). 





O 

















Working across various databases and data 

owners, the taskforce prepared the data for 
analysis and compiled it on a Microsoft Excel 
workbook. 





Generating this initial data set for analysis 
took the taskforce around two months, 
much of which was spent working with 

data owners to explain the purpose and 
secure buy-in. Subsequent extracts took 
significantly less time, averaging around two 
weeks per request. 


Once the data set was ready for analysis, 
the taskforce was able to visualise the data 
and run queries to establish a number 

of interesting patterns and relationships. 
Noteworthy observations included: 
undisclosed clusters of relationships 
identified from multiple customers with the 
same IP address, email / correspondence 
addresses attempting to log into online 
banking accounts at the same time; and 
multiple attempts within a short (24 hour) 
timeframe to log into a single online banking 
account from IP addresses associated with 
multiple jurisdictions. 
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TECHNOLOGY SPOTLIGHT NON-TRADITIONAL DATA ELEMENTS FOR AML/CFT INVESTIGATIONS 


What happens when you increase the level of integration between data traditionally associated with different domains of risk, 
such as AML/CFT, anti-fraud and cybersecurity? Institutions experimenting with this approach are finding that breaking down 
traditional silos and applying innovative analytic techniques can yield meaningful insights for risk detection, management and 


prevention. 
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For example, in addition to IP addresses, AML/CFT investigators are also experimenting with analytics using other non- 
traditional data elements, such as data associated with private and public network access points (e.g. WiFi hotspots), HTTP 
cookies and local shared objects ("LSO"), as well as WHOIS registration information (e.g. individual, company or address 
associated with the registration of a website domain). 


STRATEGIC IMPORTANCE 


End-to-end, Bank A's experiment applying 
network analytics to customer data involving 
non-traditional data elements took around 
one year. The experiment, according to the 
chair of their taskforce and the Hong Kong 
Head of FIU, yielded three key takeaways for 
Bank A. 


First, invaluable lessons were learned 
concerning the practical challenges of 
running a Regtech PoC / experiment and 
shared with other regional AML/CFT teams 
and FIUs within the group. 





Key lessons include the importance of 
communications and securing buy-in 

and support from internal stakeholders 
such as data owners, the time and effort 
required to ensure sufficient data quality 
and completeness, and limiting scope and 
clearly defining purpose at the outset to 
avoid being overwhelmed by the countless 
possibilities down the road. 


Second, network analytics (as used by 
Bank A in the PoC) and the use of non- 
traditional data elements are more useful 
for intelligence-led investigations, rather 
than for passive monitoring. It can be a 


valuable tool for inquiry, rather than a tool to 


generate alerts. 


Last, and perhaps most important, the 
chair of their taskforce noted the “learning 
journey during the process and staff 
development” were just as, if not more 
valuable than the short-term results 
generated by the PoC. As IP addresses and 
other non-traditional data elements evolve 
and become more information-rich, Bank 
A hoped the analysts involved in this PoC 
have learned “thinking outside the box” and 
that approaching investigations with a spirit 
of possibility and trial-and-error can lead to 
real, tangible results. 
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Bank B 


Bank B is a Hong Kong bank that is part of a larger regional financial services group. It offers a range of 
services across retail, corporate and private banking to a medium-sized customer base. While its group 





has pursued Regtech adoption for a number of years, Bank B has been advancing Regtech adoption in its 


Hong Kong operation since 2019. 


CONTEXT & BACKGROUND 


Unlike banks that began their Regtech 
adoption journeys by identifying existing 
pain points as possible use cases, Bank B 
began with an interest in the possibilities of 
RPA as a technology. 


Because its group was a mature adopter of 
RPA, Bank B was able to learn the underlying 
requirements and expected benefits of 
deployment across AML/CFT processes, 
Based on these exchanges, Bank B's Head of 
Financial Crime Compliance ("FCC") viewed 
RPA adoption as a secure stepping stone 

for the team in Hong Kong to gain valuable 
experience and become better positioned 
to adopt more advanced Regtech solutions, 
such as those involving machine learning, in 
the future. 








REGTECH APPLICATION 





n mid-2019, working with their internal 
office focused on wider Fintech adoption, 
which facilitated internal experience sharing 
and provided advice, Bank B began a broad 
review of processes to identify those that 
would be suitable for automation using RPA. 


The review was guided by a framework 

that looked for processes that are manual 
(operated by a human analyst), repeatable 

/ high frequency (the process is repeated 
often enough to generate efficiency gains), 
structured (minimal variance between cycles 
of running the process) and deterministic 
(one set of inputs will always produce the 
same outputs). 


The review identified name screening and 
adverse media searches for correspondent 
banking profile reviews as ideal candidates 
for automation. Bank B explained these 
legacy processes were unnecessarily 
manual and time-consuming. For example, 
analysts would have to manually retrieve 
ownership information from third-party 
data sources online, copy and paste the 
information into a name screening system, 
and review any search results. 





The same names would also need to be 
entered and searched online for adverse 
news. Not only were these processes 
repetitive and time-consuming, Bank B also 
found the nature of the work led to analyst 
fatigue and burnout, which appeared to 
correspond with increases in the risk of 
human error and poor judgment. 














After receiving internal approval, Bank B 
worked with the RPA vendor servicing group 
head office over 15 months to implement 
the solutions in Hong Kong around name 
screening and adverse media searches. 


The Head of FCC noted that this was 
longer than first anticipated. In retrospect, 
the longer timeframe was due to 
underestimating the knock-on impact 

any changes to existing internal systems 
would have on the new RPA solution. For 
example, the bank did not realise a change 
to a system's interface design (e.g. moving 
the location of a button on a webpage), 
would require a corresponding change on 
the RPA solution so that it could continue 
to function as expected. During the system 
development, user acceptance testing 
"UAT") and even production rollout stages, 
there were updates and enhancements to 
the various internal systems involved in the 
automation effort, and each round of RPA 
updates required a fresh UAT. 
































Despite the unanticipated challenges, by 
September 2020, Bank B had implemented 
RPA across their name screening and 
adverse media searching processes for 
correspondent banking customers. 
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TECHNOLOGY SPOTLIGHT LOW-CODE / NO-CODE PLATFORMS 


Low (or no)-code application development platforms allow business users without a deep technical background or ability 

to code to rapidly prototype and create software in a visual, drag-and-drop environment. These platforms, which many RPA 
vendors on the market offer, could make technology solutions to AML/CFT challenges more accessible to a wider population. 
We spoke with an analyst who has been using low-code platforms to prototype software solutions to describe their 
experience. Below is an excerpt from our conversation. 


ANALYST A 


a Years of Industry Experience: 5+ 
Programming Experience: Limited (MATLAB at School) 
(J Academic Background: Economics 


When did you start using low-code platforms? 


“Around 5 years ago. Most of the applications | have worked on have been regulatory compliance based applications, one of them 
being a case-management tool that can help clients to ensure that they are compliant with AML/CFT-specific regulations.” 


How have low-code platforms changed the way you work? 


“The biggest benefit of a low-code platform is that anyone is able to pick it up. The drag-and-drop interface allows developers to 
learn, and fix mistakes, quickly. When writing detailed queries in SQL, I've literally spent hours combing through my code looking 
for why the script might have failed. With low-code it's much easier to see where things are going wrong and drag-and-drop means 
much of the large chunks of code are already written”. 


What are the major benefits of a low-code platform? 


“Another big benefit is that we are able to develop applications in a short time frame. As we work in a dynamic environment, the 
flexibility of the platform allows us to work with our stakeholders and develop solutions in a more efficient and effective manner. 
There are a number of visualisation features built into the platform that allow easy creation of usable management information 


STRATEGIC IMPORTANCE 


With the RPA solutions in production, Bank 
B is currently evaluating opportunities to 
apply more sophisticated Regtech tools 
involving machine learning techniques 

to their name screening and transaction 
monitoring ("TM") processes. The year- 
and-a-half experience of deploying RPA 
provided Bank B with a number of lessons 
and experiences that carry forward to 
future Regtech initiatives, such as use 
case identification, scoping, business case 
development, as well as vendor selection 
and performance monitoring. 


("MI"), without having to move data between systems”. 





The year-and-a-half experience of 
deploying RPA provided Bank B with a 
number of lessons and experiences that 
carry forward to future Regtech initiatives. 
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Bank C 


Bank C is a Hong Kong subsidiary of an Asia-Pacific financial services group, offering a range of products 
and services locally for retail and institutional customers. Bank C is a relatively new adopter of AML/CFT 


Regtech, launching its first initiative in 2019. 


CONTEXT & BACKGROUND 


As part of a larger financial services group, 
the adoption of Regtech for Bank C can 

be organised into two general categories: 
group-wide solutions driven by head office, 
and locally driven solutions that do not 
impact systems or processes outside Hong 
Kong. 


At the group level, since 2017, Bank C's 
parent has piloted a number of AML/CFT 
Regtech solutions, including two that use 
machine-learning techniques to enhance 
TM alert investigations. In Hong Kong, 
Bank C established a four-person FCC 
Transformation team within the AML/CFT 
function in 2019, tasked with identifying 
opportunities to enhance local AML/CFT 
capabilities using innovative technologies. 




















REGTECH APPLICATION 


One of the first enhancement opportunities 
identified by the team involved deploying 

RPA across its TM alert investigation 
processes—namely, various data retrieval 
and routine analytic tasks, including: 





Customer information (demographic, 
account and product information) 
retrieval from the core banking system. 





Transaction data retrieval and basic 
routine analysis (e.g. identifying 
counterparties with the highest 
transaction volume). 


External database searches (e.g. 
identifying any adverse / negative 
information from news media databases). 





According to the head of the FCC 
Transformation team, these legacy 
processes fit the criteria for RPA deployment 
in many ways: the process involved many 
manual steps across a number of systems; 
led to clear, deterministic outcomes; and 
was repeated frequently. 





The team selected these processes over 
other common enhancement areas, such 
as Know-Your-Customer ("KYC") / Customer 
Due Diligence ("CDD"), because of their 
relative simplicity. As first-time adopters, 
their logic was to start small, and reduce 
project complexities by minimising their 
dependency on other departments and 
systems. 


In total, end-to-end automation of the data 
retrieval process took six months. The first 
three months were spent understanding the 
user requirements, defining the process and 
interviewing RPA service providers. Once 
the underlying requirements were agreed 
and the vendor was selected, the team 
worked with the vendor's engineer to script, 
test and refine the sequences followed by 
the software robot. 
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TECHNOLOGY SPOTLIGHT ATTENDED & UNATTENDED RPA 


RPA has been one of the most common technologies adopted by banks in Hong Kong for AML/CFT purposes (roughly 65% of 


adopters according to our 2019 survey), but the potential for automation extends far beyond the use of RPA. 


Unattended automation refers to automation that significantly reduces manual human intervention. By integrating more 
cognitive technologies, such as machine learning and NLP/NLG, automation efforts that started with RPA can move closer 


to unattended automation. Automation not only allows human analysts to focus on their comparative strengths in problem 


solving, it also creates a wealth of structure data and metadata on which analytics can be applied. 


Analyst compiles 
names to be 
screened 


Analyst performs 
searches across 
various 
databases. 


Analyst reviews 
alerts to either 
clear or escalate. 


Analyst 
documents 
rationale for 
discounting or 
escalating alerts. 


STRATEGIC IMPORTANCE 


The RPA solutions supporting Bank C's TM 
alert investigations have been in production 
since July 2020. 


While post-implementation impact 
assessments remain ongoing, an initial 
review highlighted a number of early 
benefits and lessons. The teams at Bank C 
are better able to handle periods of higher 
alert activity, and they have learned a 
number of lessons around the importance 
of anticipating and programming for 
exceptions that don't hinder humans, but 
could easily cause robots to malfunction or 
crash. 


ATTENDED 


Robot pulls names and other 
identifying details from source 
systems. 


UNATTENDED 


Robot performs the searches, 
archives the results and logs the 
activities in a logfile. 


Robot assigns a probability score to 
alerts based on the facts available and 


Machine historic data on human decision making. 


Learning 


Robot performs more routine analysis to 
clear lower level” alerts (e.g. wrong DoB 
on a name screening alert) 


Robot performs more complex 


analysis (e.g. selecting results of 


Machine adverse media searches for review) 


Learning / NLP 


Machine 


Learning / NLG Robot provides explanations for 


decisions in human-readable format 
(e.g. summaries in a text file). 


Bank C's logic was to 
Start small, and reduce 
project complexities 
by minimising their 
dependency on other 
departments and 
systems. 
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Bank D 


Bank D is a Hong Kong subsidiary of a large overseas bank offering wealth management, asset 
management and investment banking services. Bank D and the global functions that support the group's 











operations have been upgrading their technology infrastructure and adopting Regtech solutions for over 


five years. 


CONTEXT & BACKGROUND 


Whereas many of the banks profiled have 
focused more on the processing abilities 

of AML/CFT Regtech, Bank D began by 
focusing on how AML/CFT-related data is 
captured, stored and accessed. The initiative 
to modernise their AML/CFT data repository 
began over five years ago as part of a wider 
initiative to standardise the IT infrastructure 
supporting the bank's global wealth 
management business. 


Prior to this initiative, downstream AML/ 
CFT systems such as name screening, 
adverse media searching, and transaction 
monitoring were each fed by multiple 
upstream KYC and product systems that 
held customer, transaction and trade data. 
Stand-alone requests for data, for instance 
as part of an FIU investigation, would also 
need to be made to an ad hoc reporting 
team. The silo-ed architecture and manual 
processing of data requests translated 
into operational inefficiencies and cost. 
Fulfilling one of these ad hoc data extracts 
or reports, for instance, could require a 
dedicated team two or more weeks to 
produce. 
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REGTECH APPLICATION 


Over two years, Bank D upgraded its data 
infrastructure to address many of these 
inefficiencies by focusing on aggregation 
and access. It created an intermediary 
data repository between the upstream 

and downstream systems that aggregated 
over eight billion data points covering 

KYC, transactions and trade data from the 
various upstream systems. The intermediate 
data repository, while continuing to feed 
the downstream AML/CFT control systems, 
also provided users, such as FIU and AML/ 
CFT analytics teams, direct, near real-time 
access to the data for ad hoc requests and 
ongoing reporting. 


The creation of this intermediate data 
repository allowed AML/CFT specialists 

to directly pull data extracts from the 
repository and perform proactive data 
analytics reviews. The initial reviews 
conducted by the AML/CFT specialists were 
described as “look across” exercises, where 
the team would explore the data to see if 

a risk pattern identified by their FIU in one 
instance could be identified in others within 
the customer data. 


When the repository went live, the team 
performed three exercises. Within 18 
months, the team was able to run 10 
reviews, which also began producing 
findings that led to STR filings to law 
enforcement. 


Example: 
RIGHTS OF REPRESENTATION 
"LOOK ACROSS" REVIEW 


An FIU identified a suspicious client 
group where parties held "rights 

of representation" (e.g. authorised 
signatories; power of attorney) across 
multiple client relationships despite not 
being beneficial owners. 


The upgraded data infrastructure 
allowed Bank D's financial crime risk- 
focused data analytics team to carry 
out a "look across" exercise to See if this 
type of pattern existed across other 
client groups. 


This exercise identified a number of 
other suspicious client groups, which 
were escalated to the FIU for further 
investigation. 


Controls were designed based on the 
identified typology and implemented 
across the bank. 
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TECHNOLOGY SPOTLIGHT | LOW-TECH INNOVATION 


Many early adopters are finding that with AML/CFT Regtech, the best solutions 
are not necessarily the most sophisticated. Today, many of the questions asked 
by analysts during the course of an investigation can be answered by pairing the 
analyst with the right data and a colleague who can translate the question into a 
data query using open source programming languages, such as Python or SQL. 


Take for example an incident like the Panama Papers from 2016. In the 
immediate days and weeks following news of an event like this, AML/CFT 
professionals at banks may want to know if there was any suspicious customer 
activity in the weeks immediately preceding the news. 


Using open source analysis tools in Python, such as “pandas”, along with 
visualisation libraries such as “Matplotlib”, an analyst could go through 
transactional data to group the original dataset and see summed transaction 
values across the defined period. 


Example 1: going through thousands of rows of transactional data and 
calculating daily transaction values. 


Input: 
grouped data = dataset.groupby(‘Transaction_Date’). 
agg({Transaction_Amount':['sum']}) 
grouped data 


STRATEGIC IMPORTANCE 


In addition to the immediate efficiency 
gains that came from various users’ direct, 
near real-time access to data, the highly 
aggregated data storage solution also 


sum 


allowed Bank D to test AML/CFT Regtech en 
S 


olutions involving more advanced data 


tens) ne 24,095,377 

ntensive technologies using Al. For example, mn Au 
Bank D is currently testing a combined 48,015,002 

Wing machin sE: BN 
utilising machine learning algorithms, an Al- 

e 

a 








nhanced approach to TM, and a network 














nalytics tool that can assist the bank's FIU Example 2: plotting the results visually on pandas using Matplotlib. 
in exploring undisclosed or less obvious 
relationships between entities involved in Input: 
their casework. plot = grouped_data.plot(kind='line', legend = False) plot.set_ 


xlabel("Date") 
plot.set_ylabel("Amount") 
Output: 
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Bank E 


Bank E is a Hong Kong subsidiary of an international bank offering a wide range of services, including 
retail products, in multiple Asia-Pacific jurisdictions. Bank E has been studying and applying data and 


technology-driven approaches to AML/CFT for over a decade. 


CONTEXT & BACKGROUND 


Bank E has applied a range of technology 
solutions to enhance a number of its AML/ 
CFT processes. One of the areas where 

Bank E applied an Al-aided Regtech tool is in 
name screening. 


Prior to deploying their Regtech solution, 
Bank E had over 300 analysts working 

on name screening cases. With alert 
volumes increasing year-on-year due to 
corresponding increases in watchlists and 
customer volumes, Bank E—like many 

peer multinational institutions—strived to 
enhance operational efficiency and optimise 
resource allocation associated with name 
screening. 














The previous manual approach to name 
screening also exposed the bank to 
potential errors resulting from a number of 
factors. Analysts, for example, who spent 
much time reviewing and clearing hundreds 
if not thousands of alerts (many of which 
are deemed “false positives”), could possibly 
overlook some data or fail to document all 
the relevant details. 
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REGTECH APPLICATION 


In 2017, when Bank E began solving for 
these challenges, introducing Regtech 
solutions into the name screening processes 
was not new. Some financial institutions 
were using attended RPA to automate the 
data entry aspects of the name screening 
process, while others were beginning to 
experiment with machine learning-enabled 
solutions that would “score” alerts based 

on the likelihood that they were a positive 
match before introducing them to human 
analysts. 


























What set apart Bank E's ambition was the 
desire to find an automated solution that 
would issue explainable recommendations 
to escalate or close, instead of just assigning 
probabilistic scores to alerts that would still 
require human review. The bank wanted 

a tool that would reduce human effort in 
clearing alerts, while still meeting the same 
rigorous control standards applicable to 
human decisions. 














Unsurprisingly, Bank E could not find a 
solution readily available in the market that 
met these criteria and the bank ultimately 
chose to partner with a third-party vendor 
specialising in AML/CFT applications of 
machine learning to co-develop one. 








Bank E and their vendor trained their 
machine learning models on training 

data, which mainly comprised previous 
name screening alerts and corresponding 
decisions made by human analysts. As 

the iterative process of training the model 
began to yield positive results, Bank E ran an 
internal PoC with the goal of validating that 
its machine learning solution could solve 
alerts for several sample jurisdictions. The 
bank set an ambitious success criterion for 
the PoC: solving a minimum of 25% of alerts 
without making errors, and with sufficient 
explanation on how the model arrived at its 
decisions. 























The PoC was a success, and 12 months 
after the launch of this initiative, Bank E 
was able to take the pilot into production. 
The majority of this time was spent 
developing and rebuilding the internal 
processes and controls and completing 
more exhaustive testing across more 
complex markets. Although this resulted 
in a lengthy implementation process, Bank 
E felt it was the right decision as it helped 
build confidence with internal stakeholders 
across the bank in terms of model risk, Al 
governance and audit, as well as external 
stakeholders, such as regulators in 
applicable markets. 
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TECHNOLOGY SPOTLIGHT EVOLVING OUR RELATIONSHIP WITH REGTECH 


The relationships we are forming with Regtech tools are changing. 


Regtech tools today can certainly help us complete tasks we don't necessarily want, or are not best suited, to do. Think of 
tools like RPA automating repetitive data entry for name screening; these automation tools in many ways are our assistants. 
As banks enrich their data landscapes and adopt more cognitive technologies—such as machine learning-aided solutions— 
Regtech tools have the ability to grow from assistants handling processes, to something closer to partners solving problems. 


They can help us complete critical tasks better by mimicking us when we are at our best, and point out potential errors 
or make recommendations, much like Bank E’s name screening tool. Further afield, Regtech leveraging more advanced 
applications of Al has the potential to help us approach problems for which we are ill-equipped, like suggesting new and 
emerging money laundering typologies across vast pools of data before they are identified and codified by humans.” 


The Assitant 

Takes care of 
routine, easy-totrain 
tasks, but 

requires 

direction. 


STRATEGIC IMPORTANCE 


Bank E and its third-party vendor's machine 
learning-powered name screening solution 

yielded a number of immediate and second 
order benefits for the institution. 


As an immediate benefit, the machine 
learning tool improved the overall 
effectiveness of alert investigation 

by ensuring all alerts were reviewed 
consistently against all available sources. 

It also improved the efficiency of 
investigations by reducing the number of 
manual alert reviews by approximately 35% 
across multiple jurisdictions (as high as 50% 
in some), and increasing the time available 
to review higher value alerts. 


of 


The Coach The Partner 

Keeps an eye out A team mate that works 
for possible alongside you to think 
improvements outside of the box and 


within defined find solutions to 
boundaries. problems. 





The machine learning-enabled solution 
increased the consistency of review 
quality, reduced the number of manual 
alert reviews by approximately 35% to 
50% across multiple jurisdictions and 
increased the time available for analysts 
to review higher value alerts. 
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Bank F 


Bank Fis a subsidiary and regional head office of a large global bank offering a wide range of services, 
including retail products, across Asia-Pacific. Bank F has been studying and applying data and 
technology-driven approaches to AML/CFT for over a decade. 
















































































CONTEXT & BACKGROUND Adding to these challenges were the As mentioned, one of the key challenges 
substantial losses related to trade-based for Bank F was bringing together parties 
Among its many AML/CFT Regtech l : A: 8 P \ 3 E 
S a À fraud and money laundering. Commercial across multiple jurisdictions. In this case, a 
nitiatives, Bank F has been using innovative l l \ : ZN 
loan defaults, and resolving disputes, relationship manager gathered intelligence 
technologies to address challenges ae : i F 
; l litigation and regulatory actions tied to regarding TBML related to a drug cartel 
associated with commercial fraud involving X. PAS a 
adverse incidents have led to significant in one account, and used the connected- 
trade products and trade based money : Nl 
aundering ("TEML") costs." parties functionality within the bank's 
Ei customer relationship management ("CRM" 
pem ; : REGTECH APPLICATION ; ; i E C l 
As banks providing trade finance services tool to link this to another account. Prior to 
now all too well, identifying possible fraud Bank F had been studying potential the introduction of their network analytics 
and money laundering within cross-border applications of network analytics (also tool, this and other even more manual 
trade has been challenging because it often nown as graph analytics) since 2008. In approaches to reviewing documentation 
involves several parties across multiple 2013, as the first of several applications for signatories were the only means to 
jurisdictions, and is either extremely data involving network analytics, Bank F make these connections. By introducing 
intensive (documentary trade) or data implemented a solution in Hong Kong the network analytics tool, Bank F was able 
oor (non-documentary trade). Identifying that identified high-risk customers and to identify additional companies that were 
indicators of common fraud and TBML transactions based on a variety of internal inked to the first two parties by using linked 
typologies, such as round tripping and and external data, including: wholesale phone numbers and email addresses. 
multiple invoicing has often required client data, correspondent banking data, Further analysis of account activity 
analysts and client relationship managers trade data, payments data, and other determined money laundering concerns 
to manually retrieve, prepare and analyse external data such as company registries, related to some of the companies now 
data from various internal and external internet domain registries, and adverse established within this network. 
sources to uncover hidden relationships media databases. 


between trade partners or discrepancies 

in underlying data and documentation. Not 
only were these approaches prohibitively 
time and resource intensive, their efficacy 
was also often limited by the silo-ed way the 
data was typically held across internal and 
external sources. 


An example from 2015 will help to illustrate 
how network analysis was used to enhance 
Bank F's ability to identify a networ 
demonstrating high ML/TF risk. 
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TECHNOLOGY SPOTLIGHT NETWORK ANALYTICS & GRAPH DATABASE MODELS 

Many network analytics applications today are establishing and analysing relationships using data that is still stored in 
relational databases, where entity data that have been stored in tables of rows and columns must be linked through a 
separate set of operations (JOIN Table or Lookup Table) that establish their relationships. These “non-native” applications 
of network analytics are costly and inefficient compared to their “native” counterparts, which build applications on top of 
database models that store relationships between data alongside the data itself (or “graph database models”). 


Relational Database Graph Database 

Using table joins to gather transactions on a particular Doesn't require table joins to find relationships between 

account could become inefficient at scale. the data because graph data is structured so that all 
nodes (data rows) are linked directly by their relationships. 


Employees Dept Members Departments 


title: Project X OWNED BY 
startDate: 2018-01-01 = 
endDate: 2018-12-31 


Ss Vi 111 aFuTURE 
815 419 ne 
~ = 119 _ p0815 DEDICATED _TO 


role: member1 


VE R A42 


Associative Entity, = Organization. 
JOIN Table, 
orglD: 01234 \ 


or Lookup Table Lene { tper | 


dateOfBirth: 1980-01-0 | orgName: OrgA / 


AML/CFT programmes, especially at larger financial institutions, consume massive amounts of data in a fast paced 
environment. For network analytics to perform under these conditions, users are increasingly looking at graph database 
modelling and native applications to remove legacy impediments to cost and efficiency.” 





STRATEGIC IMPORTANCE This subsequent tool was launched on a 


Suspicious Party #1: Company A. AG a 
E ae eee Oe ie ect By 2016, three years after the initial global platform, buik in partnership with 
ggering : avendor that provided more advanced 


i j i iva deployment in Hong Kong, Bank F had Sha 
Reliable intelligence on cartel activity de el bee vka hed NE capabilities in entity resolution and network 
that a suspected money launderer Faik To a Scere ie RR analytics." The goal was to enable Bank F 
coordinated money transfers to ... . p 6 to process data in a manner that provided 





























" lobally, and around 80% of their entire j Dona ; 
Company A Dn din ween se dn a detailed but holistic view of its customers 
Suspicious Party #2: Company B > 5 a and their networks on a robust and scalable 
Company B was identified by the the tool has led to the review of around 
pany . , platform. 
Relationship Manager to be in 100 customer relationships for AML/CFT 
the same group (same directors, reasons. These customers held around The new solution is now in production 
authorised signatory) as Company A. USD 500 million in clean or unsecured across multiple jurisdictions and leverages 
exposures. Even if 10% of this exposure a data lake with over 40 billion rows of data. 
was unrecoverable, the tool contributed to It is being used across multiple lines of 
En around USD 50 million in savings for the business as part of ongoing efforts to move 
Email Address group in terms of fraud loss. to a more intelligence-based approach 
The returns on Bank F's investment into 8 Ay she el ee ut ae 
the development and deployment of this ransaction monitoring capa lies in ong 
Kong and other key markets with high 








tool were not limited to the immediate 
Suspicious Party #3: Company C impact on anti-fraud and AML/CFT efforts. 
Network analytics tool uncovered The preparation work on the bank's data, 
an additional company, Company C, the familiarity with network analytics 

which was only linked to Company A gained by users and decision makers and 
through phone numbers and email other lessons learned through the tool's 
address. deployment all helped Bank F secure 
Account reviews for Company A, management buy-in for a new, more 

B and C revealed potential money advanced tool that is currently being piloted 
laundering concerns. across a number of different markets. 








volumes of data and continues to evolve and 
scale today. 
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Section [Il 
Thematic 
Insignts 



























































The approach and timing for adopting AML/ So when we started speaking with early 
CFT Regtech will be different for every adopters, we were particularly interested 
bank. A bank branch expecting to maintain in asking MLROs and other AML/CFT Getting Started 
a relatively small footprint, for example, practitioners, who did not have a deep 
may find the costs outweigh the expected background in data or technology, how 
efficiency benefits of automating certain they began their own journeys into AML/ 
manual repetitive tasks. What is important CFT Regtech, how they experienced Data & Process 
is that management's decision on the and overcame obstacles to adoption, and— Readiness 
extent to which to adopt AML/CFT Regtech nowing what they know now—what 
should be based on an informed, holistic they would suggest to others who are 
consideration of the risks, benefits and considering getting started. 
costs: At the highest level, we found that AML/ Third Party Vendor 
Our conversations with MLROs and CFT Regtech adoption has been less of a Relationships 
other representatives from non-adopter sprint for many of these early adopters, and 
institutions since 2019 found that more of an exercise in orienteering. It has 
too often decisions concerning been less about advanced software and 
AML/CFT Regtech adoption were tooling, and more about the clarity of the People, Talent 
heavily influenced by vague or inaccurate institution's AML/CFT vision and objectives, & Culture 
perceptions: “[Regtech] applications are its willingness to begin a potentially long, 
too expensive and resource intensive for arduous and uncertain journey, and its 
us", “this is over-engineered for our ability to encourage and empower its people 
needs", or “artificial intelligence applications to innovate throughout. Performance Metrics 
are too much of a ‘black box’ for us.” In ; y & Indicators 

n this section, we look at how different 
some cases, the focus on technology and 

banks worked through some common 


the perceived effort required to make sense 
of AML/CFT Regtech seemingly ended the 
conversation before it ever had a chance to 
begin. 


barriers to AML/CFT Regtech adoption to 
provide perspectives to those encountering 
these issues today, and considerations 
based on actual experience for those 
discussing adoption in the near future. 
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Getting Started 


THE CHALLENGE 


Figuring out where and how to 
get started can feel overwhelming, 


especially for leaders without a data or 


technology background. 


EARLY ADOPTER INSIGHTS 


You're beginning a marathon, not a 


sprint. Secure management buy-in early 


and throughout to build credibility; 


avoid working in silos (gain perspectives 


through diversity); and accelerate the 
adoption process by learning from the 
experiences from others both within 
and outside your organisation. 


QUESTIONS FOR CONSIDERATION 


e Have we thought through the 


tradeoffs between the possible paths 


forward? 

e Are management expectations 
aligned to the approach we're 
proposing to take? 

e Do we have a forum to share AML/ 
CFT Regtech adoption experiences 
across our organisation? 





For those leading their institutions’ adoption 
of AML/CFT Regtech, the journey ahead can 
feel daunting and complex. 


Defining the business case, understanding 
the data and technology requirements, 
standing up and running change 
programmes, securing investment and 
buy-in, liaising with regulators....the list 
goes on. Couple this with the reality that 
most banks must deal with multiple teams 
and accountable stakeholders, often in 
multiple jurisdictions, and even starting the 
journey, let alone organising and governing 
it effectively, can be a tall order, even for 
the most seasoned executive. Throw in the 
competing pressures of Business-as-Usual 
("BAU") and uncertainties that must be 
managed as they arise, and one can quickly 
see why the most common questions from 
non-adopters since 2019 were: where and 
how do we begin? 


oe 


IS THERE A RIGHT WAY TO BEGIN? 


One of the debates on Regtech adoption 
centres around scale and focus. Is it better 
to start smaller and scale up or to plan and 
prepare so that you can go big? Is it better 
to start with a focus on a specific use case 
or ona specific technology (or technologies) 
that can service a range of future demand? 


We learned from the early adopters profiled 
in Section Il that all of these approaches 
can (and have) yielded positive outcomes. 
Bank A identified unusual customer activity 
through their point-in-time use of network 
analytics. Bank D's multi-year investment 

in large-scale transformation of their 

data architecture opened up countless 
downstream opportunities for their FCC and 
FIU teams. What is more interesting than 
the ability of these different approaches to 
yield results is this: the outcomes aligned 

to the original expectations going into the 
adoption initiatives. 











Description 


Expected Benefits 


Expected Challenges 


Examples 


Use-Case- Led 


Starting with a specific 
business or risk outcome 
and executing any 
technology, data, process 
or people changes around 
this end goal. 


Easier to explain 
expected outcomes for 
sponsors; 

Likely to yield earlier 
benefit; 

Easier to benchmark 
against other AML/CFT 
initiatives in the market; 
Can be specific when 
requesting time 

and input outside of 
immediate teams; 
Easier to anticipate 
sponsors and 
stakeholders to manage 
at the outset; 

Earlier exposure of the 
technology to AML/CFT 
teams (or end users). 


Securing support if 
sponsors sit across 
multiple functions with 
competing priorities; 
Requests (e.g. data 
extracts) often less of 
a priority compared to 
those for large-scale 
programmes; 
Scalability of the 
solution when/if 
expanding to further 
use Cases; 

Integration of solution 
into strategic operating 
models. 


BankA 

Non-traditional data 
points to spot suspicious 
activity. 


Solution-Led 


Starting by investing in 
data, systems and/or 
infrastructure changes 
that could lead to a large 
number of downstream 
benefits across multiple 
use Cases. 


Easier to define and 
request technical 
expertise; 

Multiple downstream 
benefits / use cases 
often unlocked; 
Often drives general 
improvements to the 
data environment, 
which pays dividends 
during future Regtech 
initiatives; 

Often facilitates 
general upskilling 

of end users on the 
data environment, 
which again can lead 
to efficiency and 
effectiveness gains 
during subsequent 
Regtech initiatives. 


Securing buy-in without 
“overpromising” at 

the outset and miss- 
managing expectations; 
Outcomes and timing of 
outcomes can be hard to 
forecast; 
Experimentation is key 
from a programme 
expectation perspective, 
but challenging from a 
BAU and stakeholder 
management 
perspective; 

Solutions are evolving 

at a rapid pace so shelf 
life and relevancy can be 
difficult to manage. 


Bank D 

Focus on compliance data 
storage solution. 

Bank F 

Focus on network 
analytics technology. 
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Nature of Approach Scale of Approach 


Large Scale 


Planning and preparing for 
a multi-year investment 

to achieve wider 
organisational impact and 
transformation in the long 
term. 


Larger scale 
programmes, once 
signed off, will often 
provide priority status 
to requests compared 
to ad hoc ones; 

Likely to formalise 
working relationships 
across functions / 
disciplines; 

Steady pipeline of 
downstream benefits / 
use cases; 

Can often entail 
transformative 
benefits, such as 
improved access to and 
aggregation of data. 


Harder to get approval, 
longer path to starting 
(consider also: shelf-life 
of solutions); 
Expectations and 
scrutiny on outcomes 
and benefits will be 
higher and omni- 
directional; 

Harder to “steer the 
ship” due to size, 
stricter governance and 
oversight; 

Investment outside of 
data and systems (e.g. 
people and org. design) 
required to fully realise 
benefit. 


Bank E 

Transformation of name 
screening process using 
machine learning. 

Bank D 

Large scale transformation 
of their compliance data 
environment. 


Small Scale 


A focused investment 

into a discrete initiative to 
achieve a measureable set 
of short term outcomes or 
proofs of concept. 


Lower cost and 
commitment, often 
easier to seek 
approvals, particularly 
locally; 

Shorter time to hands- 
on activity; 

Can, but not guaranteed 
to, integrate into wider 
solutions or initiatives; 
Shorter value 

cycles, benefiting 
sponsor /stakeholder 
management; 

Often easier for AML/ 
CFT teams to appreciate 
and maintain focus / 
momentum. 


Lack of awareness 

can lead to duplicated 
efforts across the 
business; 

Time required to raise 
support versus shelf-life 
of the outcome; 
Realising value 
beyond the immediate 
time horizon (or the 
expectation from 
sponsors to do So). 


Bank A 

Timeboxed experiment 
with IP addresses and 
network analytics. 

Bank B / Bank C 

RPA as a stepping stone 
for considering other 
more mature technology 
solutions. 
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CONSIDERATION 1: 

SECURE BUY-IN EARLY AND MAINTAIN THROUGHOUT 
HOW DO YOU EFFECTIVELY ORGANISE 
YOURSELF AROUND AML/CFT REGTECH Several banks highlighted the criticality of obtaining and maintaining business 
ADOPTION INITIATIVES? support for any AML/CFT Regtech adoption initiative. Bank B in particular 
described how they spent a month before launch engaging with senior 
management to ensure they understood and bought into the underlying 
problem statement and detailed cost-benefit of the proposal. Senior executives 
and business sponsors may not be as familiar with AML/CFT processes and 
controls (the value that is obvious to you, may not be obvious to them), so 
starting early and getting sponsors to a place where they can explain the value 
of a proposal in their own words to other stakeholders, such as board members, 
is important. 


Most if not all AML/CFT Regtech adoption 
initiatives will involve more than one 
function within an institution. In many cases, 
it will require coordination with teams in 
overseas jurisdictions. If, for example, an 
investigative function serving a region out 
of Hong Kong adopts a solution involving 
cognitive technologies, as Bank E did, then 
the markets that rely on that regional 
function will need to understand and 
evaluate the solution’s impact on their ability 
to meet their local AML/CFT regulatory 
requirements. 





Leaders from early adopters also highlighted the importance of early and 
accurate cost estimation. Bank E and others warned that first-time adopters 
run the risk of underestimating development, deployment and especially 
maintenance costs, and overestimating the immediate and long-term benefits 
of the solution. 











The involvement of multiple stakeholders 








is as essential as it is difficult. The early On the other hand, Bank A and Bank F emphasised the value of maintaining 
adopters we interviewed shared a number enthusiasm and buy-in throughout the implementation initiative. The longer- 

of lessons they learned throughout their term value of both banks’ early investments in network analytics was that it 
journey. Three key lessons on getting established the general arguments for applying these tools to AML/CFT in their 
started are worth highlighting: the criticality organisations. This broad foundation of understanding and support has allowed 
of early and ongoing stakeholder buy-in; Bank F to progress to deploying network analytics in various aspects of AML/ 
diversifying perspectives by building CFT. 

interdisciplinary adoption teams; and 

creating forums to share views and CONSIDERATION 2: 

experience across jurisdictions. BUILD CROSS-FUNCTIONAL, INTERDISCIPLINARY TEAMS 





Bank E, Bank F, and other mature adopters of AML/CFT Regtech cite the 
importance of diversity in the teams that lead AML/CFT Regtech initiatives, as 
well as the FCC and FIU functions these solutions ultimately support. Diversity 
in this context often means bringing together subject matter experts in financial 
crime, data, technology and the institution’s products and business operations, 
with functional experts who possess skills around change management, 
programming and engineering, design and communications. 


This diversity broadens perspectives and enables institutions to achieve things 
such as evaluating third-party Regtech vendors, identifying secondary benefits 
/ uses for a solution, anticipating potential road blocks to implementation, and 
securing the buy-in discussed previously. 


The principle of building interdisciplinary teams applies to even early-stage 
AML/CFT Regtech initiatives involving relatively straightforward applications 
of RPA. Bank B, for example, established a Fintech committee to govern all 
Fintech-related initiatives, including those under the umbrella of Regtech. 
The team comprised senior management covering project management and 
technology transformation, end-user perspectives (AML/CFT professionals), 
systems development, key business-level decision-making and third-party 
vendor management. With support and oversight from Bank B's local board of 
directors, this committee helped those leading the AML/CFT Regtech initiative 
challenge and shape the business case, and obtain broad-based support for 
implementation. 
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CONSIDERATION 3: 
SHARE EXPERIENCE TO ACCELERATE ADOPTION 


Finally, for institutions with group operations spanning multiple markets, 
creating forums to share and exchange ideas and experiences can accelerate 
AML/CFT Regtech adoption. 


Bank A's use of network analytics in 2019/20 is an example of this. As described 
in Section II, Bank A's internal peers overseas had previously tried and failed 

to obtain meaningful results using IP addresses. Lessons from these failed 
experiments subsequently led the bank to take a more surgical approach, 
limiting the scope of the exercise. 


What made this possible was a culture and organisational set-up that allowed 
the exchange of information and experience. Bank A has forums at the local, 
regional and group levels where AML/CFT Regtech is discussed. Most recently, 
the Hong Kong AML team’s use of network analytics and IP addresses was 
presented at the local bi-monthly forum chaired by the Hong Kong CEO and 
attended by senior leaders from across the business. 


Regionally, the use case was shared with the leads/representatives of FIUs from 
each of the Asia-Pacific markets, and a seminar was conducted with over 100 
investigations team members on the use of non-traditional data elements, such 
as IP addresses, and the applications of AML/CFT Regtech more broadly. 


As one of the leaders from Bank A noted: “using both ‘top-down’ and ‘bottom- 
up’ approach[{es] can be quite effective on the collaboration with regional/global 
partners.” 
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Data & Process 
Readiness 


THE CHALLENGE 


How did early adopters prepare their 
data and processes for adopting RPA 
and network analytics? 


EARLY ADOPTER INSIGHTS 


Anticipation is a key to success. 
Anticipate situations that could throw 
a wrench in the robot's path, or the 
data owners who may need a little 


more convincing to participate in the 
experiment (or prioritise your request). 
Manage expectations; allocate sufficient 
time for preparation. 


QUESTIONS FOR CONSIDERATION 


e Have we thought through “unhappy 
path” scenarios for the process we 
want to automate? 

e Do we have performance data on 
the process we want to automate as 
a benchmark? 

e Who “owns” the data we need to run 
our network analytics experiment? 





Banks have been collecting, storing and 
using data for AML/CFT for years. Driven 
largely by legal and regulatory requirements, 
they have been investing in technology 

to collect and store their customer and 
transactional data, as well as analytics to 
monitor and understand their customers’ 
behaviour. The same applies to AML/CFT 
policies and procedures. Banks have spent 
decades engineering and re-engineering 
the frameworks and protocols that guide 
their staff on how to comply with laws 

and regulations, and manage the risks of 
financial crime. 


So with decades of experience on AML/ 
CFT data and processes, out of the 40+ 
institutions we interviewed over the past 
year, why did so many raise data and 
process as roadblocks to AML/CFT Regtech 
adoption? 


One possible explanation lies in the nature 
of the technologies underlying the Regtech 
solutions that are becoming available today. 
From data quality to process documentation 
and metadata, the standards that were 
sufficient for yesterday’s solutions may no 
longer be sufficient today. 


This section therefore focuses on how early 
adopters have prepared their data and 
processes for AML/CFT Regtech adoption. 
Specifically, we look at readiness in terms of 
RPA and network analytics — two forms of 
Regtech that have gained interest amongst 
Accelerators (those beginning their AML/CFT 
Regtech adoption journeys) and Enablers 
(those who are beginning to approach more 
sophisticated and cognitive applications of 
AML/CFT Regtech). 
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CONSIDERATION 1: PROCESS COMPLEXITY 


Bank C approached adoption by thinking about RPA as a simulation of user 
activity that was highly repetitive and required limited human judgement. This 
made their target processes involving TM alert investigations attractive for 
RPA. However, looking back, Bank C also encourages banks to consider if the 
user activity is the correct activity in the first place. In other words, could you 
enhance, streamline or standardise the process before deciding on whether to 
automate it using RPA? 


Avoiding this step could lead to unnecessary project delays and cost. In Bank 
C's case, because the various systems involving TM alert investigations that the 
robot interacted with were not updated prior to RPA deployment, subsequent 
changes to the systems required stopping and updating the RPA solution. 


CONSIDERATION 2: DOCUMENTATION & DETAIL 


Is there sufficiently detailed understanding / documentation of the processes 
being automated? At Bank B and Bank C, documentation of high-level 
procedures was in place but both banks had to invest time in developing the 
detail around their target processes. 


Bank C had to define keystroke-level procedures to provide the required input 
to the developers (in this case external vendors), for example, down to the 
location of a button on a webpage that had to be clicked to initiate a search. 


Bank B had to think through and define how human analysts would respond 
when things didn’t go right (or what are called “unhappy path scenarios”). If the 
third-party database containing ownership information was down, what should 


the analyst do? Without designing for these contingencies, Bank B learned, the 
robot would either shut down or errors would need to be identified after the 
fact in log files by humans. 


HOW DO WE PREPARE OUR MANUAL 
PROCESSES FOR AUTOMATION? 


The majority of banks in Hong Kong that 

















have begun to adopt AML/CFT Regtech Lastly, Banks B and C were primarily looking at customer, transaction or 

have done so through automating existing negative news data, all of which was digitised. Any paper-based or non-readable 
manual processes. Two reasons for RPA's formats would need to be considered in the context of investment and cost 
popularity are: first, that it is a relatively versus benefit. 

non-invasive solution — the robots act 

like an ordinary user, replicating functions CONSIDERATION 3: PROCESS DATA & METRICS 

currently done by humans to extract and 

retrieve data — and, second, the main Tying into the overarching theme of stakeholder buy-in and measurable 

value statements of RPA — cost takeout outcomes, Bank C highlighted one of the challenges associated with RPA: 

and resilience — are attractive and how do you measure the benefits if you don't have the data? For instance, on 
easy to understand. For many AML/CFT average, how many adverse / negative news searches does a human process in 
programmes that have seen the number a day? What is the error rate? 

of processes and headcounts balloon over 

the years, the opportunity to lower cost and Measurement is not limited to quantifiable measures. The impact of a solution 
increase quality (not only of the outputs, on your people and their reaction should also be considered. For example, do 
but of their staff's state of mind) through analysts running name screening searches feel the searches are a valuable use 
technology was a welcome challenge. of their time and talent? 





For institutions considering the use of RPA 
in their AML/CFT programmes, Bank B and 
Bank C offer valuable insights from their 
recent experience deploying the technology 
across anumber of AML/CFT processes. 


Investing the time and effort upfront to create data around processes targeted 
for automation will provide leaders with an edge in crafting their narrative and 
securing ongoing support for AML/CFT Regtech initiatives. 
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CONSIDERATION 1: DATA SOURCING & DATA GOVERNANCE 


HOW DO WE PREPARE TO START USING Bank F, which has been using network analytics at scale for over five years, 
NETWORK ANALYTICS? emphasised the criticality of having data of sufficient quality. “Network analytics 
is particularly vulnerable to data weaknesses...which can drive accidental 
linkages and missed risk factors.” Once the desired application of network 
analytics is agreed, one of the first priorities must be the high-level identification 
of systems that contain the data required to run the requisite scenarios, data 
quality checks, cleansing, formatting and remediation as required. 


The art of establishing relationships and 
identifying patterns in a sea of data has 
been a fundamental pillar of AML/CFT 
investigations since before the emergence 
of graph databases and network analytics. 
The appeal of these technologies to those 
involved in investigations involves at least 
two aspects. First, the visual interface of 
these technologies brings clarity to how 
investigators interact with data sourced 
from various internal and external 
databases. Without underemphasising the 
data preparation work involved, the ability 
to toggle criteria and explore how entities 
e connected across multiple attributes 
exponentially increases the productivity of 
nvestigators, who otherwise would have 
had to spend days and weeks manually 
pulling together the data and creating 
the networks. Second, more advanced 
applications of network analytics that 
involve Al (e.g. deep learning algorithms 

for graphs), allow investigators to access 
machine-generated insights drawn from 
data volumes that far exceed the reaches of 
human cognition. 


Bank A, which piloted a much more limited application of network analytics, 
echoed Bank F’s sentiments. Despite their more targeted ambition, the data they 
required for their pilot were stored in various systems managed by different 
teams. It took them around two months to receive relevant data from internal 
partners, who had to manage competing priorities to deliver the extracts. The 
data they received then had to be massaged for analysis, which also required 
time. 




















Bank F, which invested in standardising the practice of cleansing and formatting 
data during their initial deployment of network analytics, highlighted how 

this decision reduced the time required to get future deployments of network 
analytics up and running. Bank D and Bank E, which also use network analytics, 
addressed this challenge by spending the first few years of their Regtech 
adoption journey on data transformation and laying a strong foundation for 
future applications. 





ied) 








CONSIDERATION 2: INTERNAL & EXTERNAL APPROVALS 





Because one of the benefits of network analytics lies in its ability to provide 
investigators with much richer context in which to lead their inquiries, the more 
contextual data you can feed into the system, the better. The challenge, as 











Bank A as well as Bank D, Bank E, and Bank Ẹ, alluded to by Bank A and Bank F, is not only sourcing the data from the various 
are all using or experimenting with network upstream systems, but also getting the commitment and approvals to do so. 
analytics. These banks shared a number of Building a clear communication and execution plan around obtaining necessary 
considerations for banks exploring network external and internal approvals (including system owners) for moving data to a 
analytics as a possible tool for their AML/ single location from different jurisdictions and systems was therefore critical for 
CFT programmes. these banks. 


System development teams should recognise that as network analytics requires 
data from multiple systems, it can take time to secure approvals and build feeds 
to source systems. If a bank already has standardised cleansing and formatting 
processes, this will significantly reduce the time it takes to start running network 
queries. The more significant time taken is to implement at scale through the 
use of large datasets, using the chosen platform and the subsequent build of 
the network analysis. It is at scale that the true benefits of network solutions 

will be seen. In anticipation of this scale, cloud-based solutions, or horizontally 
scalable solutions must be considered early, so that there will be enough 
computational power to demonstrate the interconnectivity interactively. 
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Third-Party 
Vendor 
Relationships 


THE CHALLENGE 


How to assess potential AML/CFT 
Regtech partners, especially those that 
show promise but are relatively new to 
the market. 


EARLY ADOPTER INSIGHTS 


The criteria used by many early 
adopters can be distilled down to 
compatibility, scale and sustainability. 
Unless you're only looking at a vendor 


for a point-in-time initiative, consider 
what the relationship could look like 
across scenarios spanning a multi-year 
time horizon. 


QUESTIONS FOR CONSIDERATION 


e Can the vendor demonstrate they 


truly understand our unique needs? 


e Will the vendor (or their solution) 
remain valuable beyond an initial 
PoC? Can they perform at scale? 


e Does the vendor's financial situation 
allow them to make the best possible 


decisions from our perspective now 
and in the foreseeable future? 





AML/CFT Regtech adoption will usually take 
one of three forms: in-house development 
of tools; procurement and implementation 
of off-the-shelf, third-party tools; or co- 
development of tools with third parties. 
These options are no different to how 
banks have been selecting and adopting 
legacy systems, such as those used for case 
management, name screening or TM. 








There are, however, three significant 
changes that have led banks to revisit their 
approach to AML/CFT Regtech adoption, 
particularly in relation to how they work with 
third parties. 


First, many third-party AML/CFT Regtech 
solutions today involve one or more 
technologies that banks feel they lack the in- 
house expertise to properly evaluate. While 
this is often associated with more cognitive 
technologies and what is often referred to 
as the “black box” problem, in interviewing 

a number of non-adopter banks, we found 
that a lack of expertise (or perhaps lack of 
confidence) has prevented some institutions 
from considering even more proven 
technologies, such as RPA. 








Second, the marketplace for AML/CFT 
technology has changed. Compared to 
when well-established, multinational 
conglomerates offered all-encompassing 
platforms that claimed to service most if 
not all AML/CFT technology requirements, 
today the market features hundreds of 
newer, smaller vendors that each claim 
to solve for a specific issue. The risks and 
advantages of partnering with one of the 
incumbent platform providers are different 
from working with an AML/CFT Regtech 
startup. This has led banks to revisit how 
they go about screening and evaluating their 
technology third-parties. 

















Finally, AML/CFT technology is becoming 
much less proprietary with the growing 
popularity of software developed under 
various open source licenses. Contributing 
to and benefiting from open source 
software development initiatives requires a 
mindset change in many institutions. 





Institutions that are currently considering 
procuring from, or partnering with, an AML/ 
CFT Regtech vendor are therefore asking: 
how do we assess, select and partner with a 
vendor in a responsible and productive way? 





HOW SHOULD WE EVALUATE POTENTIAL 
THIRD-PARTY REGTECH PARTNERS? 


The hesitation of non-adopters, especially 
institutions with a smaller organisational 
footprint in Hong Kong, to consider newer 
AML/CFT Regtech vendors using emerging 
technologies is not entirely surprising. The 
perceived effort required to assess the 
vendor and its risks — from information 
and cyber security to operational resilience 
and regulatory compliance — may feel like it 
negates the potential benefits. 

















However, the experiences of early adopters 
thus far show that others have found 

it possible to find an effective balance 
between being open to relatively new 
third-party AML/CFT Regtech vendors and 
performing due diligence. 


Representatives from Bank F, Bank E and 
Bank B shared six questions that helped 
them gain comfort with newer third-party 
Regtech vendors. 





“Adopting new 
technologies 
through more open 
source mediums 
represents a 
Significant change 
from thinking of 
knowledge as 
intellectual property 
and a competitive 
advantage.” 
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QUESTION 1: 

DOES THE VENDOR UNDERSTAND THE BANK'S NEEDS 

(OR DOES THE VENDOR'S SOLUTION MEET THE INTERNALLY DEFINED 
REQUIREMENTS OF THE BANK)? 


One of the reasons Bank E was able to define a path towards co-developing its 

name screening solution is because it did not compromise on its internally defined 
problem statement, and scrutinised vendors that claimed their solutions met their 
requirements. Bank E and Bank F found it helpful to be a “sophisticated shopper” and 
rigorously define what you are looking to buy, before engaging the market. 


QUESTION 2: 
HOW WELL DOES THE VENDOR UNDERSTAND THE PRODUCTS, 
PROCESSES AND REGULATORY REQUIREMENTS OF THE BANK? 


For Bank B’s adoption of RPA across its name screening and adverse media search 
processes, it sought out a vendor that understood the context underlying the 
processes. As a first-time adopter of the technology, Bank B found it useful to 
partner with a vendor that could not only automate but also advise on options for 
re-engineering the target processes based on similar work performed for peer 
institutions. 


QUESTION 3: 
HOW COMPATIBLE IS THE SOLUTION WITH THE BANK'S EXISTING 
SYSTEMS? 


Bank B and Bank E also sought to minimise the friction between existing internal 
systems and the third-party solution. Not only could friction translate into cost, 
certain loopholes and workarounds built for third-party solutions could also manifest 
as security threats. 


QUESTION 4: 
IS THE VENDOR ABLE TO MEET THE BANK'S SCALE REQUIREMENTS? 


This question ties back to earlier insights on aligning a bank's expectations with 

its approach. Bank F cautions against an assumption that solutions which yield 
positive results in a PoC or pilot market can yield similar benefits at scale. Managing 
expectations and evaluating a vendor's delivery capacity (e.g. headcount, market 
presence, financials, portfolio) are important steps to take prior to moving forward 
with an adoption initiative. 


QUESTION 5: 
HOW MATURE ARE THE VENDOR AND SOLUTION ON OFFER? 


Past experience is not a proxy for measuring current or future ability. However, Bank 
B and those that are new to AML/CFT Regtech adoption generally prefer vendors that 
can act as guides throughout the journey from a place of experience. Asking about 
past failures and lessons learned could prove more insightful than asking about well- 
rehearsed success stories. 


QUESTION 6: 
WHAT IS THE FINANCIAL STATE OF THE VENDOR? 


Considering the sustainability of an AML/CFT Regtech vendor is more urgent for 
startups than most traditional platform vendors. Bank F highlighted the importance 
of understanding a vendor's financial health and ownership, as both could have a 
direct impact on the vendor's decision-making. Startups may need to operate on 
shorter time horizons, for instance, or they may get acquired midway through a 
project by a competitor. Open, transparent conversations on sustainability are critical 
for banks seeking to form longer-term partnerships with AML/CFT Regtech startups. 
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People, 
Talent and 
Culture 


THE CHALLENGE 


Identifying the skills required to advance 


AML/CFT Regtech adoption, and those 


required to lead a culture of innovation. 


EARLY ADOPTER INSIGHTS 


Knowing strong communicators 
are just as valuable as those with 
critical technical abilities. Creating 
an environment where diverse 


backgrounds and perspectives are 
represented, and staff are encouraged 
by leaders to ask and act up the simple 
question: what if? 


QUESTIONS FOR CONSIDERATION 


e How diverse is your AML/CFT team? 
Or the team specifically looking at 
AML/CFT Regtech? 

e /s innovation within AML/CFT 
functions allocated with sufficient 
resources, bandwidth and support? 

e /s innovation something that 
is tangible for AML/CFT team 
members? 





Having the right talent is seen by many as 
a challenge to AML/CFT Regtech adoption. 
Around 20% of non-adopters selected 
“talent constraints” as one of the reasons 
for not adopting AML/CFT Regtech in the 
inaugural industry survey. Even among 
adopters many identified talent as an 
obstacle to advancing the use of emerging 
technologies in the field. 





In follow-up conversations, a number of 
non-adopters pointed to their lack of “data 
scientists” and the prohibitive costs of 
hiring them. Similar to the catch-all persona 
of the “IT person” in earlier generations, 

the “data scientist” has grown to mythical 
proportions in the minds of many as almost 
the gatekeepers to AML/CFT Regtech. 


Data scientists or other highly trained 
specialists are without doubt essential to 
the adoption of certain AML/CFT Regtech 
solutions. However, anumber of early 
adopters emphasised that these specialists 
are often not required until institutions 
begin experimenting with more advanced 
technologies, such as algorithms that go 
from classification and association, to actual 
insight generation. 











Moreover, we learned that even in 
situations where data scientists and other 
specialist skills are required, successful 
adoption depended less on the individual 
performance of specialists, and more on 
their ability to create value within a team of 
AML/CFT experts, data managers, system 
developers, and operations specialists. 


Therefore, in our discussions with Bank A, 
Bank D, Bank E and Bank F, we focused on 
identifying universal skills that are valuable 
for most AML/CFT Regtech adoption 
initiatives, and things AML/CFT leaders 

have done to encourage innovation and 
adoption of new and emerging technologies 
/ techniques by their FCC and FIU teams. 
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A problem oriented 
approach that 
encouraged creative, 
out of the box 
thinking. 


Prioritising the 
problem statement 
to find the shortest 
possible path to 
solutions, not the 
most advanced or 
elaborate. Creating an 
environment that gets 
people to raise their 
hand and say: “what 
ia 


Effective partnerships 
between people with 
different skillsets. 


In both Bank A and 
Bank D's experience, 
much of the value 
came from the synergy 
that emerged from 
partnering seasoned 
AML/CFT practitioners 
with data managers 
and those with 
analytics expertise. This 
allowed the AML/CFT 
practitioners to expand 
the horizons of their 
“art of the possible.” 


Communication and 
project management 
skills. 


For Bank A, 
communication and 
project management 
skills were crucial 

to bringing the 

idea to life. 
Effective, influential 
communicators are 
needed to explain 
the value of the 
experiment to data 
owners and secure 
their buy in. 





Bank A's use of non-traditional data Training and development approaches 
elements and network analytics in for AML/CFT team members are also 
its investigations, for example, wasn't evolving. At Bank D, for example, FCC and 
dependent on cutting-edge graph-native FIU team members are pursuing learning 
WHAT KNOWLEDGE, SKILLS AND software, it was all run off of Microsoft Excel opportunities to become more self-reliant 
EXPERIENCE ARE USEFUL FOR AML/CFT workbooks. Similarly, although Bank D's data in accessing and analysing data. They are 
TEAMS EXPLORING THE APPLICATION warehouse solution provided downstream earning to use tools like BusinessObjects to 
OF INNOVATIVE TECHNOLOGIES & analysts with the convenience of data extract data from the data repository, and 
ANALYTIC TECHNIQUES? aggregation and access, the actual analysis undertaking their own studies to develop 
Bank A and Bank D have both found success Often is done using queries or algorithms analytics skills utilising R and Python. 
applying a concept we have called “low-tech written in open source programming ore broadly, the curriculums for FCC and 
innovation’, or finding innovative uses for languages, such as SQL, R or Python. FIU teams at these banks are evolving to 
the data, technology and skills you have on build awareness around emerging AML/ 
hand before developing or procuring new CFT Regtech tools and innovative analytic 
eis techniques, such as Bank A's seminars on 
the use of non-traditional data elements for 
advancing intelligence-led investigations. 


An iterative mindset 
(i.e. “trial and error”). 


Bank A, Bank D and 
several other early 
adopters highlighted 
the importance of 
experimentation 

and iteration. As a 
leader from Bank E 
summarised: “it is 
important to identify 
areas of improvement, 
take incremental 

steps and try new 
approaches, instead of 
expecting a silver bullet 
to solve problems.” 
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HOW DO YOU LEAD A CULTURE OF 
INNOVATION WITHIN AML/CFT 
FUNCTIONS? 


After the successful completion of their use 
of IP addresses and network analytics, one 
of the leaders from Bank A reflected: “we 
the FCC / FIU teams] developed a culture 
and a mindset...that in order for innovation 
to be achieved, there should always be the 
encouragement of the spirit of creativity, 
open-mindedness, collaboration as well as 
trial-and-error among stakeholders.” 








t's certainly one thing to know the potential 
power of innovation, and another to 

now how to unlock it within your team. 
Building on some of the insights shared by 
early adopters, there are three additional 
considerations on what leadership looked 
ike at banks that were able to tap into their 
team’s creativity and innovation. 





"We developed 

a culture and a 
mindset...that in 
order for innovation 
to be achieved, 
there should 
always be the 
encouragement of... 
creativity, open- 
mindedness, 
collaboration as 
well as trial-and- 
error.” 
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© CONSIDERATION 1: MAKING IT REAL 


During the 2019 AML/CFT RegTech Forum, panellists representing banks and Regtech 
vendors voiced the message: “don't be afraid to just get started.” This message is as 
powerful as it is simple because it follows a core principle of driving behaviour change 
through culture, which is aligning “the talk” with “the walk”. Bank A didn’t just talk about 
innovative uses of non-traditional data in an online training course; it gave its staff an 
opportunity to experiment with it. Bank E allocated a small budget to support four staff, 
initially part-time, to dedicate time to strategy and innovation, starting with research to 
see what technologies were becoming relevant to AML/CFT. The team's scope eventually 
extended to exploring application of these technologies to everyday processes of 

the bank's FCC and FIU teams. By fighting the fear of failure and taking that first step, 
institutions can begin to build credibility around their message of valuing technology 
and innovation. 














@ CONSIDERATION 2: BUILDING SOLUTIONS WITH, NOT FOR THE USER 


The adage, “the destination is never as rewarding as the journey” tells us something 
about AML/CFT Regtech adoption. When we asked leaders from Bank E and other 

early adopters for advice they would give aspiring AML/CFT Regtech adopters, many 
mentioned the importance of bringing everyone along on the journey—not just handing 
them the shiny new tool. 


ot only does this advice help with a common Regtech challenge of getting users to 
adopt new tools and behaviours, from a cultural perspective, by building governance 
structures around AML/CFT Regtech adoption that ensure users are part of the journey, 
eaders can help to create routines / rituals and stories among staff that reinforce an 
institution's values around creativity and innovation. Stories about how a junior name- 
screening analyst's opinion was factored into the final design of an interface, or routines 
such as weekly feedback sessions with FCC / FIU teams, can all end up paying dividends 
across future AML/CFT Regtech initiatives. 











CONSIDERATION 3: COURAGEOUS DECISION-MAKING 


Bank F, with over a decade of experience in applying innovative solutions to AML/CFT 
challenges, shared the wisdom they gained through this experience that “innovation 
requires courageous decision-making—both to start projects, and to stop them.” While 
phrases such as “fail often, fail fast” speak to innovation's need for leaders to overcome 
the paralysing fear of failure, the wisdom shared by Bank F brings a more practical 
perspective that leading innovation is also about credibility. 





If off-the-shelf solutions offered by vendors do not meet internal requirements, such as 
Bank E's experience with name screening, or if development teams—both internal and 
third-party—are unable to keep up with changing user requirements, then leaders need 
the courage to avoid massaging the narrative, and pausing or stopping the initiative 
altogether. 











A culture of innovation, like any culture, is an accumulation of decisions. Showing the 
courage to not compromise on the desired outcomes, while painful in the short term, 
can help leaders add credibility to their leadership of innovation in the long term. 
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Perfo 
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rmance 
CS & 


Indicators 


THE CHALLENGE 


How are institutions defining and 
tracking value and performance 
for their investments into AML/CFT 
Regtech? 


EARLY ADOPTER INSIGHTS 


It depends on the approach, but going 
back to the concept of a marathon, 

in many instances, early adopters are 
looking beyond financial, operational 
and risk indicators to try and capture 
the less tangible, but equally valuable 
experiential learnings generated by 
AML/CFT Regtech initiatives. 


QUESTIONS FOR CONSIDERATION 


e Have we considered benefit in the 
broader context of our institution’s 
Regtech or Fintech strategy? 


e The performance of a solution will 
change over time. Is the time horizon 
appropriate to measure value? 


e Are development and culture being 
measured as part of value? 





Building a consensus around concepts like “ACh jeve me nts 


“value” and “success” for AML/CFT Regtech 


initiatives can be difficult. Depending on S h ou id n ot be 


how an institution approaches Regtech 


applications for AML/CFT uses, stakeholders m agsu red by 


from across an organisation could each 


bring varying levels of awareness, vision 8 h O rt te f mM resu Its, 


and priorities. Heads of FCC / FIU and other 


leaders of AML/CFT Regtech initiatives may b Ut th ro ugh th e 


need to navigate these at times competing 


stakeholder interests and priorities, | earn j ng jou rney 


negotiate the criteria for evaluating the 


value and success of a proposed initiative, | 
ive during the 


and manage the narrative throughout the 


project. process and staff 


For those sponsoring or leading AML/CFT 

Regtech initiatives, aligning stakeholder d eve | O O me nt.” 
expectations early on could be the 

difference between facing an encouraging 

audience or a sceptical one later on. 














We asked Heads of FCC/FIU teams and their 
business counterparts (such as COOs and 
Line of Business Heads) from early-adopter 
institutions what went into their institutions’ 
definition of value and performance. 
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HOW ARE INSTITUTIONS DEFINING AND 
MEASURING THE VALUE OF THEIR AML/ 
CFT REGTECH INITIATIVES? 


For Bank F, one of the key factors that 
enabled them to scale up their use of 
network analytics from problem statement 
to PoC and to where it is today, was being 
able to quantify and communicate the 
potential return on investment ("ROI"). 
Bank F split the metrics, indicators and 
outcomes used to assess the benefits from 
a technology, such as network analytics, into 
three categories: 





For risk mitigation, for example, Bank F 
demonstrated how their network analytics 
solution could consume more data at 
a higher efficiency than analysts and 
relationship managers to identify high- 
risk customers and transactions. Other 
banks, such as Bank B and Bank C, which 
adopted RPA, highlighted the management 
of risks associated with repetitive manual 
processes, such as human error. 

















Another key factor, cost efficiency, was 
considered by Bank F in terms of both the 
expected losses from commercial 


loan fraud, for example, and how the 
solution would impact operational budgets. 
On this latter point, while the networ 
analytics solution was more efficient than 
legacy manual reviews, Bank F pointed out 
that a more efficient and effective solution 
could lead to increased full-time equivalent 
(FTE) costs in other areas, such as the 
experienced investigators and commercial 
bankers required to review and manage the 
newly identified risk. 

















A number of other banks also cautioned 
against equating technology with immediate 
cost efficiency. In many of these cases, FTE 
cost was not necessarily taken out, but 
either reallocated to hiring for different 
roles (e.g. more experienced staff), or spent 
on staff who needed to be retrained to 
serve other functions (e.g. name screening 
analysts who require more advanced 
training). 








In terms of customer experience, Bank 

C and Bank F both noted how almost all 
technology initiatives in their institutions, 
not only AML/CFT applications, are 
evaluated in terms of the impact on the 
customer. 





For AML/CFT applications, such as Bank 
F's network analytics tool or Bank C's 

RPA solution, the customer touchpoints 
considered include, for example, reducing 


delays to customer transactions due to 
AML/CFT reviews, or reducing friction that 
could affect customer experience. 


n addition to these three dimensions, two 
thers were highlighted by a number of 
the banks. First, Banks C and F both raised 
flexibility (or adaptability) as a means of 
measuring the value of a particular AML/ 
CFT Regtech initiative. For example, one 
characteristic of Bank F's network analytics 
tool was its ability to evolve from focusing 
on commercial trade-related fraud to other 
types of fraud and money laundering. 





Oo 





Second, Bank A and Bank E both 
underscored the importance of considering 
less tangible sources of value, such as the 
impact of an initiative on a team's culture, 
or even the growth of individual team 
members participating in the initiative. 
While these benefits may be difficult to 
measure or articulate in the short term, for 
institutions planning on investing in Regtech 
in the long term, they can be invaluable to 
key determinants of success. 
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Taking Collaborators as an example, the 
HKMA has already completed work in 2020 


with ten banks 


involved in the information 


sharing publicprivate partnership to 


build out a common 


set of fundamental 


requirements around data, analytics, 


information de 


ivery, collaboration and skills 


and expertise, which will form the basis for 














thematic work 


To boost wider 





ater in the year. 


awareness about the use 


of data analytics techniques for AML/CFT 
across FMLIT Collaborator banks, the HKMA 


also hosted a 


nowledge exchange event in 





December 2020, during which three of them 


shared respect 


ive experience in the use of 


tools and techniques in network analytics. 


These collaborative efforts are already 
bearing fruit, delivering better outcomes 


such as strateg 
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Presentations on the use of network analytics during the knowledge exchange event in December 2020. 
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